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Each Orbiter Vehicle (Space Shuttle Program) contains up to 24 Kevlar49/Epoxy 
Composite Overwrapped Pressure Vessels (COPV) for storage of pressurized gasses. In the 
wake of the Columbia accident and the ensuing Return To Flight (RTF) activities, Orbiter 
engineers reexamined COPV flight certification. The original COPV design calculations 
were updated to include recently declassified Kevlar COPV test data from Lawrence 
Livermore National Laboratory (LLNL) and to incorporate changes in how the Space 
Shuttle was operated as opposed to orinigially envisioned. 2005 estimates for the probability 
of a catastrophic failure over the life of the program (from STS-1 through STS-107) were 
one-in-five. To address this unacceptable risk, the Orbiter Project Office (OPO) initiated a 
comprehensive investigation to understand and mitigate this risk. First, the team considered 
and eventually deemed unfeasible procuring and replacing all existing flight COPVs. OPO 
replaced the two vessels with the highest risk with exisiting flight spare units. Second, OPO 
instituted operational improvements in ground procedures to signficiantly reduce risk, 
without adversely affecting Shuttle capability. Third, OPO develped a comprehensive model 
to quantify the likelihood of occurance. A fully-instrumented burst test (recording a lower 
burst pressure than expected) on a flight-certified vessel provided critical understanding of 
the behavior of Orbiter COPVs. A more accurate model was based on a newly-compiled 
comprehensive database of Kevlar data from LLNL and elsewhere. Considering hardware 
changes, operational improvements and reliability model refinements, the mean reliability 
was determined to be 0.998 for the remainder of the Shuttle Program (from 2007, for STS- 
118 thru STS-135). Since limited hardware resources precluded full model validation 
through multiple tests, additional model confidence was sought through the first-ever 
Accelerated Stress Rupture Test (ASRT) of a flown flight article. A Bayesian statistical 
approach was developed to interpret possible test results. Since the lifetime observed in the 
ASRT exceeded initial estimates by one to two orders of magnitude, the Space Shuttle 
Program deemed there was significant conservatism in the model and accepted continued 
operation with existing flight hardware. Given the variability in tank-to-tank original proof- 
test response, a non-destructive evaluation (NDE) technique utilizing Raman Spectroscopy 
was developed to directly measure COPV residual stress state. Preliminary results showed 
that patterns of low fiber elastic strains over the outside vessel surface, together with 
measured permanent volume growth during proof, could be directly correlated to increased 
fiber stress ratios on the inside fibers adjacent to the liner, and thus reduced reliability. 
Associated with this volumetric response, thought tied to void compaction, was the 
discovery, though laser profilometry inspection of the interior of several flight COPVs, of 
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deep (up to 20 mil) depressions in the liner exterior. A comprehensive analysis was 
performed, which showed that these observed depressions were significantly less than the 
threshold established as a high-risk criterion for liner buckling. 
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I. Introduction 

T he Columbia Accident Investigation Report 2 addressed the Culture of Safety which existed at NASA. 
“Organizations that deal with high-risk operations must always have a healthy fear of failure - operations must 
be proved safe, rather than the other way around. NASA inverted this burden of proof ” A change in 
philosophy was mandated: the design and its operations must be proven to be safe. Prior to the Columbia accident, 
it might have been easy to disregard a safety concern or dismiss a problem in favor of what engineers thought or felt 
was acceptable to fly. The new culture of safety required that adverse data be properly scrutinized and that flight 
rationale based on sound data be developed. 

In this respect the recent Kevlar-Composite Overwrapped Pressure Vessel (COPV) Investigation represents a 
NASA success. The inter-disciplanary team with experts from industry, academia and civil service, from multiple 
NASA centers and from National Laboratories worked together to resolve a complex technical problem. The 
resulting flight rationale and continued flight decisions were based on data and analysis. It is also noted that the 
knowledge developed for the Space Shuttle Program has been propogated to successive NASA programs and more 
broadly benefitted the COPV industry. 

A. Motivation for Composite Tanks 

Introducing Kevlar-COPVs into the human spaceflight program represented a significant technical achievement 
for the Space Shuttle Program. Each Orbiter vehicle contains 24 Kevlar-COPVs for pressurized helium (for 
propulsion) and nitrogen (for life support) at pressures up to 5,000 psi. Incorporating COPVs instead of traditional 
all-metal tanks reduced the Orbiter weight 752 pounds. This weight reduction is noteworthy in light of the total 
Orbiter dry weight (176,419 pounds, for Atlantis). However, the 752 pounds is considerable relative to the Space 
Shuttle payload capability. The Space Shuttle can deliver 36,300 pounds to a 51.6° inclination orbit (as would be to 
the International Space Station) or 54,200 pounds to a 28.5° inclination orbit. 

B. Original Design Considerations 

A COPV consists of two parts; a metallic liner and a composite overwrap. On the Shuttle, the metallic liners 
were spherical shells made of titanium at a nominal (0.104”) thickness. The overwrap was Kevlar-49 fiber in an 
epoxy matrix of nominally 0.739” thickness. The primary purpose of the liner is to contain the gas within the 
realatively permeable Kevlar overwrap, however, the liner did carry 20-30% of the total load of the pressurized gas. 
The remainder was carried by the overwrap. 

During initial Program development, engineers considered all credible failure modes and mitigated risk through 
design. Early on, the primary failure mode of the vessel was considered to be fatigue of the liner, either in the parent 
material or in the welds. The design requirement for the liner was Leak Before Burst (LBB). By definition, LBB 
requires that material defects or fatigue cracks in the liner to manifest themselves in such a way that if a crack grows 
and penetrates through the liner it would continue growing slowly enough for the gas to slowly escape. This 
mechanism precludes a burst from a stress concentration of unzipping (liners were not bonded to the overwrap) and 
the sudden release of the stored energy in the compressed gas. The Space Shuttle Program underwent an exhaustive 
test program to validate this failure mechanism. Twenty tanks were experimentally cycled in fatigue to confirm this 
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concept. It is noted, however, that compressive (buckling) failures were occasionally observed. The circumstances 
that led to that failure mechanism were felt not to represent flight conditions. 

Failure of the overwrap by stress-rupture was initially presumed to be non-credible, that is, there was believed to 
be sufficient margin in the overwrap strength to preclude such failure mode. 

The original program requirements were for 100 missions in 10 years. The original certification necessitated a 
10 year life on the materials (liner and overwrap); and for cyclic fatigue concerns, the vessels would need to survive 
a number of pressure cycles associated with 100 missions. Cycle testing was performed on test articles to show that 
each vessel liner could survive a factor of 4 on what was anticipated for 100 missions. Upon retirement, the most 
flown Orbiter, Discovery , had completed 39 flights. The OMS pods have been interchanged throughout the program 
for various propulsion issues. The left pod (LP01) of Discovery was the fleet leader, with its 42 nd flight on STS- 133. 
The corresponding 40” tank (SN015) was also the fleet leader with respect to effective hours. 


C. Initial Safety Concerns 

As part of the Return To Flight (RTF) Activities following the Columbia accident, the NASA Engineering and 
Safety Center (NESC) established an investigation team, in February, 2004, at the request of the Space Shuttle 
Orbiter Project Office (OPO). On February 26, 2004, the NESC Review Board accepted this task and assigned 
Assessment 04-0 16-E. Former astronaut Kenneth D. Cameron headed up team of experts from the NESC 
Structures, Materials and Non-Destructive 

Evaluation (NDE) Technical Discipline Teams Table 1. Measured Burst Pressures of Orbiter COPVs. 

(TDT), and external, world-renown COPV 
Experts. 

The NESC Assessment Team gathered and 
built a comprehensive database incorporating 
Lawrence Livermore National Laboratory 
(LLNL) stress-rupture data on small 
Kevlar/epoxy test vessels and strands, 

Dupont/DOE replicates of LLNL Laboratory 
tanks, and Cornell University single-fiber test 
data. This Assessment Team developed 
mechanics and reliability models to 

accommodate the typical pressure and temperature fluctuations observed in the Shuttle Flight Data. The team issued 
the following preliminary findings 7 : 1) Kevlar/Epoxy (K/E) COPV are susceptible to the stress-rupture failure mode 
that can result in an explosive release of stored energy, 2) Risk is a strong function of fiber stress level, time at 
pressure (adjusted for temperature), 3) Likelihood of stress rupture failure in Orbiter COPV is significantly higher 
than previous predictions, and 4) Reliability models and supporting database need to be updated to reflect new 
knowledge as it is gained. 



26” Tanks 

40” Tanks 

Burst Pressures (psia) 

8,890 (SN-003) 

8,010 (SN-002) 


9,020 (SN-004) 

7,667 (SN-011) 


9,570 (SN-001Q) 


Fiber Stress Ratio 
(SR) 

47% 

OMS 4875 psi 
SR = 64% 



MPS 4500 psi 
SR = 53% 



Included among their findings 
was: 1) Stress Ratios for Orbiter 
COPVs should be based on actual 
measured burst strengths of specific 
tanks (OMS, RCS, MPS) not on 
design values from test coupons or 
10-inch rubber-lined vessels 
(‘Lincoln 9’). It was noted that 
significant size effect exists, i.e., 
apparent fiber failure strength is 
lower for small COPVs compared to 
epoxy-imprengated tows and still 
lower for larger COPVS - OMS and 
RCS vessels, and even lower than 
expected based on scaling from 26” 

MPS tanks (which were actually 
designed to a lower burst pressure). 

Revised Stress Ratios for OMS, RCS and 40” MPS tanks now become higher than used for original fleet leaders. 
This was of critical importance as the enveloping logic of JSC fleet leaders was no longer applicable. 


Kevlar 49/epoxy overwrap volume relative to overwrap volume in LLNL vessel 
Figure 1. Size Effect of Orbiter Tanks. Fiber strength scales with overwrap 
volume and shows anomalies for the largest tanls. 
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D. Orbiter Vessel Scaling: Importance of Size Effect 

The Orbiter vessels were built with a similar design and it would be expected that they would scale with one 
another. The measured burst strengths of certain Orbiter Vessels are presented in Table 1. For vessels that were 
similarly scaled, it would be expected that the measured burst strengths would be comparable to one another after 
accounting for the total volume of overwrap under stress. In fact, based on the two tanks that were tested the largest 
40” tanks had a considerably lower burst strength than predicted (as did the smaller RCS tanks). Thus, as vessels for 
use as either OMS or MPS tanks, their corresponding fiber stress ratios were significantly higher than as designed. 
If delivered fiber strength is 318 ksi (suggested by extrapolation of MPS 26 inch vessels) vs 253 ksi (suggested by 
SN011), then stress ratio would be reduced by factor of 1.26 and lifetime is increased by factor of (1.26) 24 = 242. 
This became a significant concern for the Orbiter fleet. In Figure 1, the scaling of apparent fiber strength with 
respect to relative overwrap volume more acutely illustrates the scaling effect. Given the measured values fall 
below this universal relation, the life of these tanks is considerably lower than originally anticipated. 

E. NESC Key Findings 

On April 12, 2007, NESC Assessment Team issued their final report 7 with the following key observations and 
final recommendations on COPV Reliability Calculations. The NESC team developed new methodology to derive 
an effective time at maximum operating pressure (MOP), based on the actual time, temperature and pressure history 
of each Orbiter COPV. The methodology is based on the cumulative damage concept inherent to all Kevlar stress 
rupture models and on Arrhenius based interpretation of elevated temperature lifetime data. At ambient temperature 
three different, independently derived, models produced consistent results, lending credibility to the overall 
methodology, but only one model was able to accommodate temperature fluctuations, using experimental 
observations on single fibers and epoxy impregnated tows. While it was not possible with the limited time 
available, to validate these models by testing, each model incorporated all available data. 

The Team provided a reliability estimate to the Orbiter Project Office prior to the STS- 114 Flight Readiness 
Review. For the cumulative risk of the system of 26 Orbiter COPVs, the estimated conditional reliability for the 
subsequent three flights was determined to be slightly better than 0.999. 

The Team also noted that for both the 40-inch OMS and MPS vessels, each vessel must have its stress ratio 
individually calculated based on acceptance data and subsequent burst test data. 


F. Tank Production History 

The COPV Team’s review of each 
original 40” tank acceptance data 
package focused on the delta volume, or 
the permanent growth in volume during 
manufacturing. During tank fabrication, 
following the winding and curing of the 
composite overwrap, the tank undergoes 
an initial pressurization up to about 
6,500 psi, whereby the Ti-6A1-4V liner 
plastically deforms so that upon 
returning to zero pressure the liner is 
placed in compression close to its 
compressive yield point. This initial 
pressure cycle is termed autofrettage 
(actually the same as the “proof cycle”), 
and following this cycle the interior 
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Figure 2. Volume Growth During Autofrettage. As a function of vessel 
build order, there were strong differences. 

liner shows a permanent volume increase, called the delta volume. The tank volume was measured throughout this 
process, after the liner was welded together, after the tank was wound with overwrap, and a third time after the 
initial autofrettage pressurization step. The precision of the measurement at the time was thought to be within 0.1% 
of the total volume which was approximately 30,000 in. Permanent growth in tank volume during this process 
became the key parameter because of its indication of the state of fiber hoop strain adjacent to the liner. Large deta 
volume growth implies through overwrap thickness void compaction (and perhaps other damage), a high stress 
gradient through the overwrap, and thus higher stress in fibers next to the liner driving up stress ratio (and 
correspondingly, a lower fiber stress on the outside. 

A comparison of this delta volume growth during autofrettage as a function of the vessel build order in the life of 
the program (presented in Figure 2) shows some importand trends. The delta volume was cacluated two different 
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ways, first using the vendor measurements 
of liner volume before and after the 
autofrettage process and second using 
measurements of the external tank 
dimensions and comparing to vendor data 
taken before the autofrettage process. 

Select measurements obtained at the White 
Sands Test Facility (WSTF) are also 
included in Figure 2. 

G. Space Shuttle Program Risk 

One way in which the Space Shuttle 
Program tracks risks is through the Shuttle 
Integrated Risk Management Application 
(SIRMA). Risks are reviewed regularly by 
Shuttle Program management; the risk 
associated with composite stress rupture 
became a top Program risk, as shown in 
Figure 3 and the 5 th highest. Here the top 
risks with their relative uncertainty are presented at the time of the Return to Flight (RTF) in 2005, prior to the 
launch of STS- 1 14. The top two risks are Micro-Meteriod Orbital Debris and Ascent Debris, both of which could be 
catastrophic if such impact damaged the structural integrity of the Orbiter. SSME is a catch-all for risks attributed to 
the Space Shuttle Main Engine. Similarly RSRB is a catch-all for risks associated with the Reusable Solid Rocket 
Booster. Crew Error on Entry refers to any number of pilot errors that might have occurred during reentry. Two 
specific failures of the Auxilliary Power Unit (APU) are of sufficient risk to be included on the list. Number 10 on 
the list relates to the hold down bolts on the Solid Rocket Booster. 

II. Orbiter Engineering Team 

Building on the initial groundwork of the NESC Assesment Team, the Orbiter Engineering Team was tasked 
with three actions: 1) Investigate COPV procurement and replacement, 2) Make improvements to shuttle operations 
to reduce effective time at pressure and 3) Develop an Orbiter reliability model to quantify future risk based on more 
recent test data and analysis of past data. These three tasks are detailed below. 

It is noted that a companion investigation considered COPV Kevlar overwrap aging 10 . During that study 
performed by the NASA materials group, there was no discernable difference between new fibers or those that had 
been manufactured thirty years ago. Additionally, specimans from the Columbia tanks, which were recovered 
following the accident, were also analyzed and within the levels of uncertainty involved differences in material 
mechanical propreties were not evident. 

A. Tank Replacement 

Orbiter engineers performed a comprehensive analysis to assess the feasibility to replace the exisiting Orbiter 
vessels. In the life of the Space Shuttle Program, one MPS 40” tank had been replaced (these are accesible), but no 
certified procedures had been developed for the OMS tanks and the program only had two certified flight spares 
available. Several scenarios were investigated. 

Option 1 was to replace existing tanks with new COPVs. Schedule considerations did not allow time for a new 
tank to be designed. Option 1A was to procure new tanks to the original specifications. Although the new COPVs 
would have comparable stress ratios as the original parts, they would not have suffered the previous time under 
pressure from the first 113 Shuttle flights. Option IB was to procure new Commercial Off The Shelf (COTS) 
vessels. The closest COTS equivalent were of cylindral shape (compared to the existing spherical design) and 
substantially larger. Such replacement would have required a complete redesign of the OMS Pods. 

Option 2 was to swap the existing OMS tanks with MPS tanks. However, it was deemed that this option was 
unacceptable given the minimal improvement to flight risk. 

Option 3 considered adding an additional tank or tanks to increase the OMS system volume. This would allow 
the tanks to be filled to a lower pressure and achieve the same capacity to deliver gas to the OMS liquid propulsion 
tanks. This was deemed an acceptable approach for the OMS system, although there was significant risk associated 
with attempting to implement such a scenario. 



■sonnel 

17 

. The Risk of a COPV 
n. 


5 

American Institute of Aeronautics and Astronautics 


Option 3 proposed strengthening existing tanks by adding additional layers of overwrap. Such an operation 
would have required extensive development, analysis and qualification effort, and would risk buckling the liners. 

Next, the team investigated replacement procedures. Certified procedures existed for replacement of MPS and 
ECLSS tanks. The team was tasked with determining feasibility to replace existing OMS/RCS tanks. During 
original fabrication, the OMS Pods were built around the helium tanks. Replacing this tank required cutting into 
major structural elements of the Pod and/or cutting through the exterior skin of the Pod, which served as exterior 
skin of the Orbiter. A preferred approach was selected although not pursued, given risks and schedule restrictions. 

The two MPS vessels which were deemed the highest risk (MPS tanks on Atlantis ) were replaced with the two 
flight spares. One of the removed tanks (SN-006) was retained for a future flight spare; the other (SN-007) was 
sacrificed for the Accelerated Stress Rupture Test, described later in this paper. 

B. Operational Improvements 

The Orbiter Engineering Team was tasked to develop changes to flight procedures to mitigate risk. One simple 
option would have been to reduce the upmass capability and reduce the pressures in the various systems, but the 
goal was to not adversely impact operations. The risk was determined to vary fairly linearly with time under 
pressure, adjusted for temperature. Effective time at standard temperature and pressure could be reduced by 
lowering pressure, temperature or time under pressure. A number of operational improvements were implemented 
which had the effect of lowering this effective time, based on model results described by a later formula. 

First and foremost, it was noted that during the loading procedure, the thermodynamics of increasing the 
pressure on loading were associated with a large increase in temperature. Introducing a two stage loading process, 
where the tank was first loaded to a set pressure (such as 60% of full operating pressure) followed by a ‘cooling off 
period’, before the final loading raised the pressure to launch loads. 

Several other changes, which collectively had a large impact were as follows. Original tank filling specifications 
defined a minimum level of pressure without imposing temperature limits; however, later experimental evidence on 
single Kevlar fibers and epoxy impregnated Kevlar strands demonstrated a significant accelerating effect of 
increased temperature on their stress-rupture performance. Thus a new operational procedure was instated that set 
specified temperature and pressure limits for future risk mitigation. Furthermore, system checkout tests between 
Shuttle flights were limited to 80% launch load rather than full operating pressure. Loading of the tanks was moved 
later into the launch preparation procedure. Originally, loading of the flight gasses occurred as early as 12 days prior 
to launch; tank loading was changed to commence at five days before launch. Also, in order to protect ground 
personnel, pad access was restricted to essential personnel after pressurizing the tanks. All personnel were restricted 
from pad access during tanking pressurization. 

The Shuttle Program was able to perform an off-load (load reduction) in the helium system for OMS, but not for 
MPS. For Shuttle Missions to ISS, pressure in the helium tanks is driven by the failure scenario of a launch abort 
(Return To Launch Site-RTLS). In this scenario, it is necessary to expel the liquid fuels in the OMS liquid 
propellant tanks in order that the Orbiter vehicle will meet landing center of mass constraints. Reducing the OMS 
liquid fuel and corresponding helium pressure meets RTLS constraints and only loses 10 pounds Ascent 
Performance Margin (APM). OMS COPV pressure was reduced from 4875 psia to 4450 psia. This pressure change 
itself resulted in a reduced effective accumulated time, per mission, from 105 hrs to 35 hrs. The risk is essentially 
linear with effective time, thus the risk to stress rupture was reduced by a factor of 3. The reduced OMS pressure 
became the standard load. The lower pressures were to be used when possible; and it was expected only two 
missions would require the full load: the ISS Assembly Mission 1J/A (STS-123) and the Hubble Servicing Mission 
(STS-125). The 1J/A mission had a particularly heavy payload, the first module of the Japanese laboratory, 
Japanese Experiment Module (Kibo). Ultimately this mission flew with the standard load. STS-125 required the 
additional propellant load for the 28.5° Inclination orbit needed to reach the Hubble Space Telescope. Due to the 
desire to take additional supplies to the ISS at the end of the Space Shuttle Program and the confidence in accepting 
the flight risk due to the conservatism in the reliability model used to quantify risk of catastrophic stress ruptre, the 
last three flights (STS-133, 134 and 135) were also flown with full loads. 

Similar MPS analysis resulted in the recommendation to not perform a further off-load. The MPS helium load 
was driven by the failure scenario in which one Space Shuttle Main Engine (SSME) ‘went out’ during Ascent. A 
100 psia offload in MPS helium corresponded to 30 seconds margin in SSME Engine Run Time. The change in 
MPS COPV risk (associated with a 100 psia offload) was considered small relative to the margine needed to 
‘protect’ against an SSME failure (additional run-time in the failed SSME scenario). 
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C. Reliability Model 

In order to quantify the risk of failure, the Orbiter COPV team developed a detailed reliability model. There are 
three essential components. First, how does Kevlar fiber perform in stress -rupture for a given stress ratio (i.e., 
sustained fiber stress level divided by effective fiber strength as determined from COPV burst test results) at given 
effective time? Second, at which stress ratio value are the Orbiter tanks when loaded to nominal pressure? Third, 
accounting for various levels of pressure and changes in temperature, what is the effective time that a COPV tank 
will experience in a typical Space Shuttle flight? Each of these three components are handled separately, as follows: 

1. Kevlar Fiber Model 

In order to develop the reliability model, the Kevlar vessel and strand databases were carefully analyzed. The 
first observation of the data was that fiber volume fraction influences apparent or ‘delivered’ fiber strength (even 
after applying the rule-of-mixtures), but the effect on stress-rupture lifetime is different. This complicated data 
interpretation in comparing various Kevlar/epoxy strand experiments, and the LLNL and Orbiter COPVs, among 
which the fiber volume fraction differed substantially. 

2. Corrections to Kevlar Database 

There were several adjustments to the database that needed to be implemented to properly characterize Kevlar 
fiber stress-rupture behavior and remove extraneous variability effects. Each adjustment, applied to the database, 
served actually to increase the Orbiter vessel reliability and were a necessary contribution to achieve flight rationale. 

Another problematic aspect arose in the LLNL vessel data base in that each spool of Kevlar fiber was used to 
make 30 vessels, and there were 8 spools, so vessel samples for each test condition were randomly selected from 
these spools. Unfortunately, the spools themselves proved to be significantly different in terms of the the burst 
strengths of their resulting vessels, and stress-rupture lifetimes they imparted to their vessels, and an analytical 
approach was developed to separate out the spool-to- spool effects in order to better quantify the variability and 
uncertainty associated with the reliability estimates. Note that the Orbiter COPVs typically mixed tows from many 
spools to make the wrap bands and the large denier spools themselves mixed smaller denier fiber sources, so the 
spool effect was not an issue. An example of the spool-to-spool effects was discovered around 1980 Dr. Frank 
Gerstle of Sandia National Laboratories. Dr. Gerstle discovered an anomaly in spool seven such that half the fibers 
had twice the cross-sectional area. 3 This anomaly source was reported as a DuPont processing error. 

In comparing stress -rupture behavior of epoxy-imprengated strands and small vessels, that had been tested 
another important discrepancy in the data was observed, particularly when comparing the LLNL and presumed 
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identical DuPont/DOE replicates. It was discovered that the liner aluminum materials were not identical in yield 
strength due to different processing, and the DuPont/DOE tanks appeared weaker in burst strength yet produced 
relatively longer lifetimes than the LLNL vessels, this led to further discovery of winter-summer temperature 
fluctuations, which coupled with “topping off vessels” found at times to have low pressures and subsequent liner 
yielding during higher temperature periods led to a pressure-temperature ratchet effect on fiber strains. This 
discovery was important to determining the proper exponent for lifetime versus stress level (about 24 versus the 
ratchet-driven 20.5) as seen in Figure 4, and thus, controlling and better understanding the level of uncertainty in the 
reliability model. Without these discoveries, reliability predictions would not have been too pessimistic to allow 
Orbiter flight. 

3. Orbiter Stress Ratio Model 

Interpretation of SN011 vs SN002Q burst strengths 5,7 and delta volumes had a large influence on determining 
stress ratios for remaining 40-inch tanks in the fleet, as shown in Figure 5. 

Factors that went into a model for the stress ratio for each OMS or MPS COPV in the fleet, stemmed from 
various scenarios and hypotheses regarding the mechanical state of each vessel (particularly their delta volumes), 
and the mechanical state and behavior 
(including delta volumes) of the two 
COPVs that had been burst tested, 

SN002-Q (data from original burst test in 
1978) and SN011 (data from highly 
instrumented WSTF cycle and burst test 
in 2006). Three models were considered, 

Models 2, 3 and 4, (where Model 1 was 
the base model using only operating 
pressure and burst strength of SN002-Q 
but discarded after the burst test on 
SN011). 

The stress ratio formulas, particularly 
Model 2, variously incorporated: (i) large 
gradients in fiber tensile stress that exist 
through the overwrap thickness and result 
from high permanent or delta volume 
growth from void compaction during the 
original proof test, and (ii) overwrap 
stiffness loss that becomes apparent after many pressure cycles following the original proof test but may not be 
immediately revealed as permanent volume growth in the proof test itself. This stiffness loss may be due to some 
combination of fiber damage during original proof and long term fiber creep effects, but the former are found to 
dominate. The stress gradient effects were treated in a Weibull strength distribution framework, to account for the 
scale effects induced by intensifying the high fiber stress over a smaller volume of fiber adjacent to the liner. Using 
the new formulas for SR various case studies were performed covering various damage and volume growth 
scenarios for OMS type vessels remaining in the Shuttle Fleet. 

The simplest model of the three (Models 2,3, and 4 in Figure 5), was used by the COPV team for Reliability 
predictions. It used the low burst strength of SN011 (7667 psi) and its high delta volume (about 336 in 3 ) together 
with the burst strength of SN002-Q (8010 psi) and its lower delta volume (256 in 3 ) to determine, through delta 
volume scaling, the burst strength and nominal fiber stress ratio for each vessel in the fleet, since the specific delta 
volume for each one could be calculated from proof test records. 

Model 2 was used for the accelerated stress rupture test discussed shortly, and took into account observations of 
potential stiffness loss and damage to SN011 seen in WSTF cycle testing as well as gradient effects through the 
overwrap thickness, that led to discounting the low burst strength of SN011 as an anomaly, highly unlikely in other 
vessels whose proof records showed no such effects other than relatively high delta volumes. 

4. Calculating and Predicting Effective Time at Pressure 

A method had to be developed to calculate the effective time, t e ff at standard temperature, T re f, and maximum 
operating pressure, p mop , relative to the clock time at actual temperature and pressure: 



Figure 5. Orbiter Stress Ratio Model. Stress ratio as a function of Delta 
Volume, or Volume Growth during autofrettage. Four candidate models 
were shown. The Program selected the less conservative Model 4. 
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teff f (p2p) 


(1) 


Prefix T re f/Top) 



Prefix re //Pop) 


where p () is a reference pressure at zero degrees Kelvin, p mop is maximum operating pressure, T ref is reference 
temperature (300 degrees Kelvin), T op is actual opeating temperature, and p op is actual operating pressure and p ref is 
the power-law exponent for lifetime vs. pressure under reference temperature conditions. From this relation, it is 
noted that excursions to high temperatures induce a significant penalty on effective time. By applying the integral 
form of this relation to the time, temperature, pressure profile during a mission cycle, from loading through launch 
and landing, it is possible to calculate the effective time that had accrued during a single flight. 

In a typical flight cycle, the tanks would increase pressure during loading, but would also increase in temperature 
due to thermodynamic effects. The tanks would be loaded a few days before launch and stay pressurized for several 
days until launch. Often times there would be several launch delays due to weather conditions or technical 
conditions with other Shuttle subsystems. During the ascent phase, the SSMEs would fire during the first 8.5 
minutes of flights. The bulk of the mission’s MPS helium consumption would occur during this ascent. The 
pressures would decrease appreciably such that subsequent risk to this failure mode was neglible. During the ascent 
phase, the OMS would also perform a thruster firing. Although small compared to the overall OMS engine firings 
throughout the mission, the helium tank level would fall sufficiently to reduce the pressures such that subsequently 
COPV risk would be very small. 

Calculating the exact effective time after the mission might be of general interest, but merely an acadmic 
exercise with respect to calculating the risk after the mission took place. In order to assess the risk before the flight, 
it was necessary to preduct ahead of time what the effective time would be for a mission cycle. Historical data was 
useful in estimating the loading profiles that would be realized, even after the improvements were made to the 
Shuttle operational procedures. It was noted that operational changes reduced accumulated effective time (and 
hence risk) by a factor of 2.5. 

One key factor was to estimate launch delays that might extend the number of days the Orbiter tanks stayed 
pressurized prior to launch. OPO decided to carry two days margin for launch delays. It was noted that in the 
history of the program, the average number of days was closer to 5. However, this average was closer to 2 for the 
RTF flights, post Columbia. For the last 20 flights of the Shuttle Program, these estimates proved conservative. 
95% of the projections for predicted effective time were below the values realized (often as much as 50%); the 
remaining 5% of the projections which exceed the targets did so by 3-10%. 

Changes in the Space Shuttle Program flight manifest also impacted the COPV risk. There is a different risk 
attributed to each Orbiter; changing the number of flights per vehicle (while keeping the total number of flights 
constant) affected the overall risk. For the Hubble Servicing Mission (STS- 125, Atlantis ), special preparations had 
to be taken to enable a Launch on Need (LON). Because this mission did not reach the International Space Station, 
a LON needed to be available within seven 
days or consumables on Atlantis would run 
out before the rescue vehicle arrived. To 
support this contingency launch requirement, 
the Orbiter COPVs on the rescue vehicle 
needed to be pressurized prior to the launch 
of STS- 125, essentially placing an extra cycle 
and accruing effective time of one flight on 
the backup vehicle COPVs. The last minute 
postponement of the STS- 125 flight resulted 
in STS-127 (Endeavour) instead of STS-119 
( Discovery ) serving as the contingency rescue 
vehicle. The flight risk was tracked 
throughout the Space Shuttle Program and 
updated to account for these types of manifest 
changes. 
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5. Released Reliability Model 
A graphical user interface (GUI) model 
developed in Matlab was released for 
calculating the reliability. This tool was 


Figure 6. Reliability Calculations. Presented at the Space Shuttle 
Program Requirements Control Board on October 18, 2007, the 
Orbiter Team presented the reliability per flight, per Orbiter Vehicle 
and for the life of the program. Discovery (OV-103), Atlantis (OV- 
104) and Endeavour (OV-105) reliability numbers are presented 
separately; the cumulative risk is on the right hand side of this chart. 
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configured for each Orbiter vehicle and was used to evaluate various Shuttle flight configurations and special 
conditions. The tool was available for use by the Space Shuttle Community. Standard configuration management 
practices were maintained so that restlts were reproducible and interested parties could independently review 
assumptions and parameter inputs. 

6. Evaluating Reliability 

The Orbiter engineering team was tasked to quantify the flight risk through the end of the program. The model 
accounted for the update Kevlar database, the conservative stress ratio model and historical loading data to predict 
future accumulated time. 

For a given a Orbiter mission, three separate reliability numbers were generated. The Point is the reliability 
prediction calculation based on the best-estimated values for key parameters. To account for uncertainty, a Monte 
Carlo Simulation was performed with key parameters randomized with a log-normal distribution, tied to the amount 
of data in the data base used in their estimation. The Mean and the 95% Confidence Limit was calculated from 
these simulations. 

The Orbiter Engineering Team calculated the risk for the remainder of the program; the sumnary of the 
calculations that were presented to the Space Shuttle Program Requirements Control Board on October 18, 2007 are 
shown in Figure 6. In the Purple Box, the per flight reliability numbers for each Orbiter vehicle are shown, for the 
standard load (with the reduced OMS helium loading) and with the full load (without the off-load). Based on the 
flight manifest at that time, for the number of flights scheduled for each Orbiter vehicle, the numbers below the 
purple box are the risk per vehicle. The total risk to the Space Shuttle Program which is the product of the risk for 
the three Orbiters, is on the right hand side of the slide, circled in red. 

A few interesting points should be noted. After the two MPS vessels were removed from Atlantis , that Orbiter 
vehicle went from having the lowest reliability to the highest reliability. The remaining risk to the fleet was 
primarily borne by three tanks; one OMS tank on Discovery and one OMS and on MPS tank on Endeavour. 

The risk to each flight was considered as an independent event. For two subsequent flights on the same vehicle, 
extending the time on the first flight did affect the risk of the subsequent risk, the difference was neglible compared 
to the significant relative to the precision of the analysis. 

For the Space Shuttle Program, the Orbiter Team based risk decisions on the Mean reliability. The difference 
between the Point and the Mean estimates provided a way to evaluate uncertainty in the risk determination. The 
95% Confidence Limit was carried at the request of several individuals who preferred to assess risk in that manner. 

7. Adding Model Confidence through Test 

Flight certification is dependent on the reliability analysis to quantify the risk of stress rupture failure in existing 
flight vessels. Full certification of this reliability model would require a statistically significant number of lifetime 
tests to be performed and is impractical given the cost and limited flight hardware for certification testing purposes. 
One approach to confirm the reliability model is to perform a stress rupture test on a flight COPV 6 . 

Since an extensive and fairly consistent data base is available on both ambient and elevated temperature 
performance of Kevlar49®/epoxy materials and small test vessels, the test was also accelerated in time by a factor of 
about 40 (under the pessimistic parameter assumptions) using a higher steady temperature than occurs in service 
(though not higher than has typically occurred in the past during the pressurization phase) but at the maximum 
operating pressure used in service. This strategy was designed to provide the necessary test information in a few 
months rather than the 200,000 hours (28.5 years) that would be required under standard service conditions. In fact, 
two temperature levels were selected to be run in sequence: the first at 130° F was to be applied until the time 
corresponding to mean reliability of 0.9986 was reached under the most pessimistic stress ratio and Weibull lifetime 
parameter values. At that point the temperature was to be increased to 160° F and the test continued until the vessel 
either fails in stress rupture or survives a pre-set time at which a third stress level would be contemplated. 

III. Additional Investigations 

Unti the end of the Shuttle Program, the COPV Engineering Team was regularly tasked to perform analyses. 

A. Accelerated Stress Rupture Test-Bay es Analysis 

Full certification of the Orbiter reliability model would have required a statistically significant number of 
lifetime tests to be performed and was impractical given the cost and limited flight hardware for certification testing 
purposes. The Space Shuttle Program was limited to performing a single test on a flown vessel, SN-007 wich was 
removed from Atlantis. The Bayes Analysis 9 was performed to establish a criterion by which the single data point 
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would show increased confidence in the developed reliability model. Mathematically, how long would the single 
test vessel need to survive in which the model was shown to be valid? How long would the single test vessel need to 
survive to show that the model had significant conservatism? 

Because the vessel far exceeded the lifetime estimates, it was universally accepted that there was conservatism in 
the model. However, had the vessel failed early, this analysis would have been critical to properly evaluating the 
impact on the reliability model calculations. 

B. Raman Spectroscopy 

Instead of determining fiber stress ratio from the delta volume during the original manufacturing process, a 
Raman Spectroscopy technique was proposed as a Non Destructive Evaluation technique 4 . Raman Spectroscopy 
technique for measuring certain patterns of fluctuation in fiber elastic strains over the outside vessel surface (where 
all but one wrap is exposed at certain locations) that are shown to directly correlate to increased fiber stress ratios 
and reduced reliability. 

This technique was carried as a backup in the event that the Accelerated Stress Rupture Test had identified 
further work was needed. 

C. Liner Buckling 

Routine boroscopic inspection of the interior of an Orbiter COPV tank identified anamolous local depressions or 
valleys (indentations towards the center ) in the titanium liner, these markings were presumed to have appeared after 
proof testing. The question was raised as to whether these indications increased the potential for liner buckling or 
were merely a cosmetic consequence of manufacturing whose impact on vessel integrity was inconsequential. 

The analysis of the problem was to presume a depression of a prescribed magnitude and then detmerine if such a 
depression could lead to liner buckling. For the 40” Orbiter COPV, a criterion of 40 mil depressions was established 
as the critical depth at which buckling might develop. The measured magnitudes on the interior of the Orbiter tanks 
were less than 20 mil, and the Orbiter fleet was exonerated from this failure mode. 8 

D. Addition Reliability Calculations 

Throughout the investigation and until the end of the Space Shuttle Program, the Orbiter Team was tasked to 
perform special analyses for flight activities. One example of the special analysis was for the STS- 134 Launch. 

STS- 134: The COPV helium tanks were filled (on April 21, 201 1) in preparation for the STS- 134 Launch with a 
targeted launch date No Earlier Than (NET) April 29, 2011. The tanks were loaded early as to not interfere with 
employees observing the Easter holiday. Due to the Auxiliary Power Unit (APU) anomaly and Range restrictions at 
Cape Canaveral, the next launch opportunity was NET May 8, 201 1. Actual launch could have been further delayed 
due to troubleshooting and resolution of the APU anomaly. The COPV team was tasked to determine whether it 
would make sense, from a safety perspective, to depress the COPV tanks on the vehicle in order to reduce the risk of 
catastrophic stress rupture. 

Comprehensive calculations using the Orbiter model were performed to quantify the risk of depressing and 
repressing the flight tanks and comparing the risk to leaving the tanks pressurized. The calculations showed that for 
the OMS tank, a depress/repress would not reduce risk unless there were at least a 10 day period during which the 
OMS helium tanks will be at a reduced pressure. It was noted that the critical issue was when the vehicle would be 
prepared for the next launch attempt and not when the actual launch would take place. A depress/repress of the 
MPS helium tanks was not warranted for any reasonable delay in the launch manifest. 

IV. Beyond Shuttle 

There were a great man lessons learned from the Orbiter COPV investigation. With regards to tank 
procurement, it is essential that COPV designers understand the complete system and not simply focus on meeting 
one requirement, such as burst pressure. It was recognized that designers should design to the safety certification 
requirements and then scale appropriately for tank parameters, such as tank volume and weight. Trying to add 
safety certifications considerations after the COPV is optimized to tank parameters is nearly impossible and can lead 
to catastrophic consequences. 

The NASA COPV community has taken the safety approach from Shuttle and applied them to requirements for 
new NASA missions, including the International Space Station, Commercial Cargo and Crew, and unmanned 
scientific missions. NASA COPV engineers who worked these programs have also actively contributed to AIAA 
and ISO standards relating to COPV for which industry uses for the design and procurement of space vessels. 
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V. Conclusion 

For the Space Shuttle Program, a comprehensive investigation into the reliability of the Kevlar COPV tanks were 
undertaken. Although many Program Managers and Engineers felt that stress rupture of Kevlar fiber was not 
credible, the flight rationale was based on sound engineering data and judgement. The Orbiter Engineering Team, 
after recognizing that tank procurement and replacement was not possible, developed a comprehensive reliability 
model to quanitify the likelihood of occurance. The Program implemented changes to the operational procedures to 
reduce the risk without adversely affecting mission capability. Lessons learned from this investigation have affected 
subsequent NASA programs and benefitted the space industry overall. 
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